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5 >ti^#^> ^^^^fi^^-f ^^t&^piK, #.i&^^*t#ri£J&^t 

tiL£^&Hkxt&&4t&$L> tffc'W^-, ^4hw^, 

&&tytffi/[i^^frftfeif&fa&£ttif 

a. 

30 @ 2A-2C Tfrtfc T^J^^^^'J^^I^it#^^-^^;>5r>ir^i / ftvvt 



/S) format.com, sort.com DOS com debug.exe 

15 lable.exe 3rX.4H%£. DOS exe 3H^-4; /fl^&tf#Jfc51 -f->& . 

^fcAiSl^MiE-gML DOS boot 32^4; notepad.exe, 
word, exe ^it^ML WINDOWS pe^!^^; MXfttfjTfr4**t$L 

30 4tH). ^#^#4^tltA***^-*M-«^^<fe^^^. 
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H^CPIK ##/M*(0S), *b##«il^ 

^ifc X iti#r-*#-iL 2 ffi&^fr 1 ^ CPU t$W. itif# 

Mt&^&tLte— #£4*t|t 19, ^T^*h#^2 *titt^ 

10 ^T^-l^tlL 

^o® 1 PJjtjz , #ri£^4#->t 2 tLte—^lt^st 3, ^"f 

15 fa%t/L-*r>yL$LteM.&tf] CPU5, M.&ft#6, (OS) 7, J. 

9, -kv&tmin^; 11 (zpif#^ 

-^T^^^Vi^tf-), ^]^^#^^; -^#^^#^#->t 10, 
^] -f #/5ti£#*-**Hjt 19 ^f^/f^^it^ 4 t SMriMT. ff ^] #T 

20 i£#>£##F 11 ^#ic#i-4*l-#- 19 ^&^#^4^&^#>MH* 11 

7t 12, ^i-^i^^^^p)f^m^^^^^^m^ 

25 4^ 13 i?$lMfr##>MKf 11 tb^-, :Mfi&3l, J<U 

19 #^4> ^itj&£, J!']iO<7it^4- 18„ 

^/fiii^#-^t 2 ^|#:^^^— #r^f'J#-it 17, ^i^ji'J^ 
30 #^3£^i*^4-#*H&; —^4-^^15, 
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^*f#^-¥->t #4W<&J&^fiH^> 
ifffrfi-^Jstftf^ 16. i£yfrl&3M^#*t& 16 ^^&#fi£:£4M£#0#->L 
17 4LJ££!l#r^##4tf&19Ji, #>W^4M*>££. ^ 

CPU) 5, &&&&&&& 1. jk&ftii\%-¥>?Y^ftffii9L%-%. M.&ffi¥)3g. 

#Ti£>^ CPU5 sof tcpu ( ) ( 4&4f CPU ). sof tcpu 0 

— >h^.iLtftCPU, fife^tf^— 4m#^#jE-^*MNWr. «£tJl#, 

cpu flfeiMrtf^ softcpu Oj&fiMMr. cpu titSklftfi 

15 4Ms sof tcpu 0«W##UfT-£; Zs$b$r$k CPUiMK#*84s sof tcpu 
0&#iUK, softcpu () CPU &£i&#t4fc&^;&&flt,#P sof tcpu 

0 ^i±J-^ CPU.##^^f^t#-(^J^: BlOS&Zf, *&3&) 
ft softcpu ()|IMt##r#tf BIOS 

20 softcpu ()X;l#MM-£ CPU*§4^ — ^&$£ftZj, T^/flvC 

*»:JMHE:^lfe Intel if%-fa±tf)&^r, softcpu O^l&tf A Intel 
CPU; *»JUMt&& MAC ii%-fajLffi&4r> softcpu () &&tf]&.MAC t# CPU; 

25 

&4ki&4tf%'%¥)£^%i4t&&L, DOS tfj$L$JL%Lft&t$„ WINDOWS 95 6^ 
UNIX tf)M.to$Lft&i&$. %7$k.%%L^, &f&&2L*ftlti 
30 -H^^d, i%mM$kft&&L 7 4sL&te&4lrf%&HtfyW&&.$L'bto 



4*. DOS iMb T&%&M%Ltf&&i&% DOS ¥j&&#Lft&f&', 

^^##r WINDOWS 95 i&Wtttf&tf WINDOWS 95 

■ ^mm,8, &-*r£.fo— iz&^M-fa*\-^&m£&^jt% 

DOS 10. SYS MSDOS.SYS C0MMAND.COM), »^ AJf] ;^$']i£ifti^ML 

-ft (Xf-f DOS jUt^^^iXj&^W*: DOSEXE.EXE D0SC0M.COM 

r % f&JL&ttfl . 

hard-disk-struct iM£#J£&*£&<#^fcM, 
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f*i # t % ft , ^^M^^M^* ^ 
5 a & E , i£ ^ ^ 1£ <ft & x # ( *t -f DOS £ # 

10. SYS, MSDOS. SYS, COMMAND. COM ) , VX 7k. ft & Sfl'J T&iftifcfyiLft ( 
DOSEXE. EXE, DOSCOM. COM ^- ), ¥i4Sdfcfc&L?» £ JL-f K. 4fc/&;ML 

Ifltf — -M^#'J> -zyvXi^—^Mi^ft f loppy-disk-struct iM^^AA 

10 f ^ iL ^ ^ It A , ^ # T ^ #l it ^ £ * 4. ■ 
360K, 720K, 1. 2M, 1. 44M i#4£ito 

15 Jii£#^& CPUS, &&ftfi- 6, OS 7 

k%&^ne J &tfm3.i£t&%$ltf}> &iL&W* CPU ft 

20 &&-&tfj4f%. #'H": :^#£4^l^^^#— i&#JX^ (DOS exe 
X4+, DOS comX^, DOS bat X-ff , Windows NE i& PE X4+ ), #p&2|t 
>£^#UT^:t&; tfcn^#£4^tlblL WORD ^T^f^<ftX^X^, 

25 Xi^^i^^iSLM.^.M^^i^, &te-MtB##»*J-fe"], ^ 

f*£xt^^#^-4> ■*v£zVXCW&4r(&4 ft 26 Big/ft X ^ "X 

30 #r DOS ^4-, DOS WINDOWS 95 



WINDOWS 95 ■b°%L-g r &-$r WORD #^ A WORD ; it 

VH°, DOS com m%^$k, 
15 IK J. 60K^r^'J^^6$£>N*/fr ( IK, 2.5K, 12K, 20K, 30K, 40K 
W^t^^^- ^N84^^#J# Jmp> call, mov, xor ^H4n 

Jti^#>^^H^^^tJLi£-5r^ &fe DOS exe QtefotiMfy 
20 &#£>MHfiL'ff . &iLft-£fLirfr&}Mj 0x20, 0x200, 0x400, 0x600, 
0x800 SLftJL-ffrMftW* 10K, 20K, 40K, 80K 

^ — jJT*.'J^#J## 0x00, 0x03, 0x80, 0x87, 0x100, 0x198 %fljft\ 
&f[&&*fi&fr&\% 0x00, 0x01, 0x02, 0x04, 0x10 4f-/L*H&* 

% CS, IP ^a^i^^^#^|'fi;^^^^f a l^ , J^ 

X&fofeifrW&&&^UtLm\^m%^%i, $r&te: MSDOS, 
PCD0S, DRDOS, WIN9X ^££fc6$*|SJ#L;M»$l -f^ -f-jft E^lb 

30 jLi£Sl-^#^^£/&&^-Mt:fc> MSDOS, PCDOS, DRDOS, WIN9X^3U£ 
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3!;64o 

5 *»S 1 Apr, /*/ri£#4&&i*ML-£>L 10 X#^4#;M./Mk*. *'J/fl 

4#*£-&*i* io +*fc&lfeJi^4. £4*»J*r-£x, 12 #**4^ 

10 ^#^70 10 t ##i4^#-^^#^J^^#^^f flt^^ ti # 
7i&£, J8'JiOtii^£4*f 3^4. mHi&?£^J5m%^£.ft??%-fc4: 

4^4; ^#^^^^T#^ 13, i)LWnfoX.ft^4r#&fofe^3- 
15 (#^) &7 #^##r#^4'ft&. grJ&^ML^tf 

— ^£#'J, fll-&£-hi£,&&* DOS DOS ft J^&M.& 

j^4-#^^.^. J Mt DOS exe, DOS com i%ty-i&f$l*f » ^frvTN ^ 

20 *4"f */fr«!#4. ^^-t^4^W^t^^^.^^J^^#>## 
#ri£#>t#;^ 13 4.^— ^#:^4^^^#>t#^^--^#:^4 

25 «£<tfT4Mt#, ^Ji&^ii^Wt'f ^4, ^iMH^ittft*. 

#3^14, '&teJii£#>MHf 11 4 

^13^f^, #^#>##^t^tb^^^4-ft4^#: 

4#r^6Mt&. j&ii*iH^4#3^#3i±*i. ^4^3#l##3 



*j-f-#-i& DOS com^j^, 3 fa 14 ftAfriZ: 

^m\%fa^^^^w^^xn^^^^\%fa%fa, &*ki±& 

15 fc%-%-ftiit& 4^$#^-&#-fiNM, 15 4- 

^mt&fcfri?., fal4 %tf%%ft^¥j&4£frT&3&m&\ft& 

20 4-tfSU:#>frl&#-&. i*vfr4-^6*>£*!'J4L "flH^^.*^/^, 

10 14 r^#^3^^^it*l#^#^lfei# 

ft 1 5 *M£& & & & tfj i£i±3E Up 

30 ii#i£#J,<hUll^^^ 



ii 



— >HH*], *J&9j#7iNMMt 15 >tl^-#-itDOS com^^tf 

5 g^'Ji&^TT — ^; 2.^e##r^^j DOS com X^^.^^^^it#^^ife^ 
If CPU slM 5 *^-!! Cs fa%mft&ift&&.&&ifr&3rft^ IP 
>fl^ 0x0100 Bt^iL; 3. it##^X^vf^>GI^">^-J-^'J^ DOS 
comiC'H^-t^'h ^f" #^D0ScomiL^^^'J^ ^-^"t*. 
'Js 4. DOS com ?Pte,&&*f*}^- CS: IP ^^$>J 

10 CS: IP+^^-6^ DOS comX#^^-^'J^ (ft 1*1 ^##^ff » 

® 2A, 2B, 2C ^ifc T^^^^i^r^-^^^r^^— ^^^'J^^t^ 

f. 19 c +m sioi ), m^nrnz a ^^oi^ 4^*t#- ( S102 ). 

4s*— ^.^4-. T^^^f.— ^-sT^f^, *. exe, 

20 *. com, *. bat, .doc, PE^NEX^. ^rM E^i-^l E , 

— ^^-sr^t^-sr^— ^-sr^^-^^"^. *. txt. 

J$LS103, s£*r£#-4-*t^; JM^^-^-. K^TiMffr, 

VW°*. txt, JPJ^i* II #*t :*«B#*t|UMp, J^M£-B#*j-#- 

25 #;Mp*t#-. 

£#J|SpL S103 t > &^it#WI&#-7G 4 'Ng&tf-H-* 
*U«R*fe, CPU, ^L&OS, jL&*b-*P>?Hfr&4h 

30 >MH*H1» &teX&(fi^ft&&fy&frfttiL&&tii&s 



E-gHf^MF. £+N£Si05, ^Wi4Lft&&tf&i9 $m&£&tfj&tei1< 

#fl^-,*E4.##-*. ^i&£&#*^tt*l*JftE+«^-&. 

mS107t» :MW#3HW&!fe, JH|i£J.ffl 2B +6*|;*Nfc Sill; ^JB'J, 

10 2Bt6t#^S110, tf&mi&fa^&M.1fi&fy&ft^fo£tf^, # 
*»S2B^, #*Slll^L^-^#i-*Xt^4-» / t ^-#J^#^, 

15 4L^atJ.iNfc s.112, ^fl/A^rlNNI-. JJ'J^ 

i£J.;*NfcS113. 

^.#^S113 t» ^*M^i+#W^t^^^^#W^» 
S114 t. WW 14 

sn5, nm^fefts-tbfcte&fiL i&mifttfi&ife) *» 

^■Jltff 0i.liftj.^-m S116: ^')Hfr^.^,^^, 2C *<Hj#3£ 

S120 o 

^t#^S116 t, ^^^^i^^^^^^^^^A^it^vff^ 

25 ^##jfi£„ jL-frm sin, ftWM/'&&Mr&-&tf'4r&ft> &&M>\Mrfc-& 

#^4-^ (#*S118), (#J»S119). 

■ka® 2C?ft7jz, S120 t . M-ii^-^#^^l4^v#>1i#^t# 

•|uL$.f!]##7 #J*»: — ^ DOS com ^^^'J^T^^^'H^ 1. 
30 sM^^.^^^^^-fc; 2. ^-^^X^- virus-size; 3. alMM* i& 7 4fc 
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data -off set _in_ virus Ot@*j"^i-iM£0 . 

DOS com ^4- 1. &4b^jiQ%^$L : J&^$L&\ 2. &^¥]J^^r virus-size; 

data.offset-in_virus(;tetf^4M*0. yfrft^Ji^j^-t-^^^T: 1. it# 
^-^^^E.X#t^^5. virus_offset-in-f ile #^4^+^;^ 
10 f ils-size ^-^^A^- virus-size; 2.-itMi^^tf f ^1^- 

JL data.offset_in_file(;te#WJJL'ff) virus.off set- in.fi le 

+ data.of f set-in.virus; 3. fi\ data.of f set_in_f i le #tt£} \%r1§^ 
^iX^^^^f; 4. 4a##-4-it'ff>^-*P^# virus -size 



15 £.-frm S122 *, ^•J^^^?itit^^^t4^^^'fiL^it#^ 

JB'J (-*NfcS125); J!'Ji&.£-jNfcS123. 

^#^S124, ii^#^S119, 
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1. — #^'J^>fl^i+#^^^P5r*, &^T-^*: 

*; 

t**t«£ (CPU) -H£& CPU "mS-^; 

25 & ^ ( os ) m*i£m., m -t os 4€#^«^^*t»£ 
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DOS SLtf-Qifrty, ft^ DOS com DOS com 
>^^^D0S?|^E, £)-fi&&D0S WORD X^i^ 

7, *>M\%; 6 #fi£6^&-, ^-t^Tii^^ OS DOS, 
WI NDOWS , UN IX ^ £ ##/ft & IML— . 

15 ^i«jvj|-|^j^4-. 

fetell-^E, X^Si^, 
25 i£##T^&^X-Hs ^^^t^ Mi^4^f Wf . 

11, — #^'J^^l^it#^^^it^^^, 



2 



12, 11 ft 

13, dM**]^ ii & 12 #r^&£fc, #t#f&*t#*M&&-£>tk 

t **ka« ( cpu ) m*%-7t, m -f&& cpu ^4-; 

% & ( os ) n\ -fm* os &##^ji^^*Mfy& 

*\>^&m&&mu%-7L, tLtem&*£&* ft&^n^ 
^-f^^^jcpu, os^^^-m^. 

ift&^r, &^D0SX^#^, ^Ji^DOS com ^X-f+#& DOS com 3!^ 
DOS i* , ^]^#^D0S WORD i-fr 



16, -k*M\£:%L 15 WW*%-Jt, ft 

17, 1pM\£;$L 16 #ri£d$&&, *t^i^*» OS &&&& DOS, 
WINDOWS, UNIX#-£*Nfc#/fc*&4L--. 

18, *»*L#'J*^. 12 #ri£t#;MA, / s /ri£^4^l&^^^^Mrs£-4h 
10 yfrl^^-t-. 

19, 13 #fi£itf;?U*, ^t^f^h^«^^#->t 
£fl # t *f #— * 'J - 6fl ^ ft $ faj A , 'it ft ft ^1 1*1 

20, ^o^.j^i3^^^m,, tf&*Y^ftm^&mtt%-7L& 

ft ft t tf" #— ft I*) faj ;JM&&#Jt , itftft^i faj 
;frlfUL1jMfc&— it^iMU 

20 #*tt#tt,*/fr, vx^&R^^&^m^^^ . 

21, — #it#^L-=r-^^#^^, ^^i+#^#^J^ 1- 

10 6*:**t6^ > MM*. 

22, — #t^*fr^, ^i^itit^^^i+#^^f^'J^ 1- 
10 ^^r^ttf-M^*. 
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11 *Rfc#M*t&w#, r%.imw*, xttVimm 
mm 
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